Serve Prometheus metrics at /metrics behind basic auth (closes #94)

With METRICS_USERNAME and METRICS_PASSWORD both set, the backend
records request metrics through go-http-metrics and serves them at
GET /metrics behind basic auth with those credentials; nginx passes
/metrics to it. With neither set there is no such route; one alone
stops the start with an error naming both.

Only requests chi has matched to a route are recorded, not every
request as the conventions show: the labels are path and method, which
clients can make up without end. So POST /api/v1/reports is registered
by its full path, not inside a route group.

Deviation: go get and go mod tidy ran directly; no entrypoint adds a Go
dependency yet (#45).

Model: opus-5-5

TODO.md

@@ -23,6 +23,17 @@ latest run passes.
 
 # Completed Steps
 
+- 2026-10-04: the backend serves Prometheus metrics (issue #94). With
+  `METRICS_USERNAME` and `METRICS_PASSWORD` both set, it records each request's
+  duration and response size through `go-http-metrics` and serves them, with
+  Go's runtime and process metrics, at `GET /metrics` behind basic auth with
+  those credentials; nginx passes `/metrics` to it as it does `/api/`. With
+  neither set there are no metrics and `/metrics` is 404; one without the other
+  stops the start with an error naming both. Only requests that match a route
+  are recorded, not every request as `GO_HTTP_SERVER_CONVENTIONS.md` shows,
+  because the labels are the request's path and method, which clients can make
+  up without end. For that, `POST /api/v1/reports` is now registered by its full
+  path instead of inside a `/api/v1` route group; it answers as before
 - 2026-10-03: the frontend's unit tests cover what the page computes (issue
   #21): `humanDuration`, the latency colours of a figure and of a sparkline
   either side of each boundary, a target's min, max, average and median latency